Development October 2019

development@lists.ipfire.org

12 participants
77 discussions

[PATCH] perl: Add function to perform AS number lookups.
by Stefan Schantl 01 Oct '19

01 Oct '19

Signed-off-by: Stefan Schantl <stefan.schantl(a)ipfire.org> --- src/perl/Location.xs | 26 ++++++++++++++++++++++++++ 1 file changed, 26 insertions(+) diff --git a/src/perl/Location.xs b/src/perl/Location.xs index ab27f0b..63410c4 100644 --- a/src/perl/Location.xs +++ b/src/perl/Location.xs @@ -117,6 +117,32 @@ lookup_country_code(db, address) OUTPUT: RETVAL +unsigned int +lookup_asn(db, address) + struct loc_database* db; + char* address; + + CODE: + // Lookup network + struct loc_network *network; + int err = loc_database_lookup_from_string(db, address, &network); + if (err) { + croak("Could not look up for %s\n", address); + } + + // Extract the ASN + unsigned int as_number = loc_network_get_asn(network); + loc_network_unref(network); + + if (as_number) { + RETVAL = as_number; + } else { + //RETVAL = NULL; + RETVAL = 0; + } + OUTPUT: + RETVAL + void DESTROY(db) struct loc_database* db; -- 2.20.1

2 1

[PATCH] perl: Testsuite: Add test for lookup_asn()
by Stefan Schantl 01 Oct '19

01 Oct '19

Signed-off-by: Stefan Schantl <stefan.schantl(a)ipfire.org> --- src/perl/t/Location.t | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/src/perl/t/Location.t b/src/perl/t/Location.t index aef15c3..af5e258 100644 --- a/src/perl/t/Location.t +++ b/src/perl/t/Location.t @@ -11,7 +11,7 @@ use warnings; # Where to find the test database. my $testdb = "../../testdata/test.db"; -use Test::More tests => 5; +use Test::More tests => 6; BEGIN { use_ok('Location') }; ######################### @@ -36,3 +36,6 @@ ok($description eq "This is a geo location database", "Test 3 - Get Database Des my $country_code = &Location::lookup_country_code($db, $address); ok($country_code eq "DE", "Test 4 - Lookup country code for $address"); + +my $as_number = &Location::lookup_asn($db, $address); +ok($as_number eq "204867", "Test 5 - Lookup Autonomous System for $address"); -- 2.20.1

2 1

[PATCH] unbound: Add option to force using TCP for upstream servers
by Michael Tremer 01 Oct '19

01 Oct '19

Some users have problems to reach DNS servers. This change adds an option which allows to force using TCP for upstream name servers. This is a good workaround for users behind a broken Fritz!Box in modem mode which does not allow resolving any records of the root zone. The name server tests in the script will also only use TCP. Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org> --- src/initscripts/system/unbound | 40 ++++++++++++++++++++++++++++++---------- 1 file changed, 30 insertions(+), 10 deletions(-) diff --git a/src/initscripts/system/unbound b/src/initscripts/system/unbound index dbcfc951f..bec2ab6ef 100644 --- a/src/initscripts/system/unbound +++ b/src/initscripts/system/unbound @@ -15,6 +15,7 @@ TEST_DOMAIN_FAIL="dnssec-failed.org" INSECURE_ZONES= USE_FORWARDERS=1 ENABLE_SAFE_SEARCH=off +FORCE_TCP=off # Cache any local zones for 60 seconds LOCAL_TTL=60 @@ -25,6 +26,12 @@ EDNS_DEFAULT_BUFFER_SIZE=4096 # Load optional configuration [ -e "/etc/sysconfig/unbound" ] && . /etc/sysconfig/unbound +DIG_ARGS=() + +if [ "${FORCE_TCP}" = "on" ]; then + DIG_ARGS+=( "+tcp" ) +fi + ip_address_revptr() { local addr=${1} @@ -199,6 +206,14 @@ write_forward_conf() { ( config_header + # Force using TCP for upstream servers only + if [ "${FORCE_TCP}" = "on" ]; then + echo "# Force using TCP for upstream servers only" + echo "server:" + echo " tcp-upstream: yes" + echo + fi + local insecure_zones="${INSECURE_ZONES}" local enabled zone server servers remark disable_dnssec rest @@ -391,7 +406,7 @@ ns_is_online() { local ns=${1} shift - dig @${ns} +nodnssec A ${TEST_DOMAIN} $@ >/dev/null + dig "${DIG_ARGS[@]}" @${ns} +nodnssec A ${TEST_DOMAIN} $@ >/dev/null } # Resolving ${TEST_DOMAIN_FAIL} will fail if the nameserver is validating @@ -399,11 +414,11 @@ ns_is_validating() { local ns=${1} shift - if ! dig @${ns} A ${TEST_DOMAIN_FAIL} $@ | grep -q SERVFAIL; then + if ! dig "${DIG_ARGS[@]}" @${ns} A ${TEST_DOMAIN_FAIL} $@ | grep -q SERVFAIL; then return 1 else # Determine if NS replies with "ad" data flag if DNSSEC enabled - dig @${ns} +dnssec SOA ${TEST_DOMAIN} $@ | awk -F: '/\;\;\ flags\:/ { s=1; if (/\ ad/) s=0; exit s }' + dig "${DIG_ARGS[@]}" @${ns} +dnssec SOA ${TEST_DOMAIN} $@ | awk -F: '/\;\;\ flags\:/ { s=1; if (/\ ad/) s=0; exit s }' fi } @@ -413,28 +428,33 @@ ns_forwards_DNSKEY() { local ns=${1} shift - dig @${ns} DNSKEY ${TEST_DOMAIN} $@ | grep -qv SOA + dig "${DIG_ARGS[@]}" @${ns} DNSKEY ${TEST_DOMAIN} $@ | grep -qv SOA } ns_forwards_DS() { local ns=${1} shift - dig @${ns} DS ${TEST_DOMAIN} $@ | grep -qv SOA + dig "${DIG_ARGS[@]}" @${ns} DS ${TEST_DOMAIN} $@ | grep -qv SOA } ns_forwards_RRSIG() { local ns=${1} shift - dig @${ns} +dnssec A ${TEST_DOMAIN} $@ | grep -q RRSIG + dig "${DIG_ARGS[@]}" @${ns} +dnssec A ${TEST_DOMAIN} $@ | grep -q RRSIG } ns_supports_tcp() { local ns=${1} shift - dig @${ns} +tcp A ${TEST_DOMAIN} $@ >/dev/null || return 1 + # If TCP is forced we know by now if the server responds to it + if [ "${TCP_TUNNEL}" = "on" ]; then + return 0 + fi + + dig "${DIG_ARGS[@]}" @${ns} +tcp A ${TEST_DOMAIN} $@ >/dev/null || return 1 } ns_determine_edns_buffer_size() { @@ -443,7 +463,7 @@ ns_determine_edns_buffer_size() { local b for b in 4096 2048 1500 1480 1464 1400 1280 512; do - if dig @${ns} +dnssec +bufsize=${b} A ${TEST_DOMAIN} $@ >/dev/null; then + if dig "${DIG_ARGS[@]}" @${ns} +dnssec +bufsize=${b} A ${TEST_DOMAIN} $@ >/dev/null; then echo "${b}" return 0 fi @@ -464,7 +484,7 @@ get_root_nameservers() { can_resolve_root() { local ns for ns in $(get_root_nameservers); do - if dig @${ns} +dnssec SOA . $@ >/dev/null; then + if dig "${DIG_ARGS[@]}" @${ns} +dnssec SOA . $@ >/dev/null; then return 0 fi done @@ -514,7 +534,7 @@ resolve() { local ns for ns in $(read_name_servers); do local answer - for answer in $(dig +short "@${ns}" A "${hostname}"); do + for answer in $(dig "${DIG_ARGS[@]}" +short "@${ns}" A "${hostname}"); do found=1 # Filter out non-IP addresses -- 2.12.2

1 1

[PATCH v2] unbound: Add option to force using TCP for upstream servers
by Michael Tremer 01 Oct '19

01 Oct '19

Some users have problems to reach DNS servers. This change adds an option which allows to force using TCP for upstream name servers. This is a good workaround for users behind a broken Fritz!Box in modem mode which does not allow resolving any records of the root zone. The name server tests in the script will also only use TCP. Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org> --- src/initscripts/system/unbound | 40 ++++++++++++++++++++++++++++++---------- 1 file changed, 30 insertions(+), 10 deletions(-) diff --git a/src/initscripts/system/unbound b/src/initscripts/system/unbound index dbcfc951f..d195fd325 100644 --- a/src/initscripts/system/unbound +++ b/src/initscripts/system/unbound @@ -15,6 +15,7 @@ TEST_DOMAIN_FAIL="dnssec-failed.org" INSECURE_ZONES= USE_FORWARDERS=1 ENABLE_SAFE_SEARCH=off +FORCE_TCP=off # Cache any local zones for 60 seconds LOCAL_TTL=60 @@ -25,6 +26,12 @@ EDNS_DEFAULT_BUFFER_SIZE=4096 # Load optional configuration [ -e "/etc/sysconfig/unbound" ] && . /etc/sysconfig/unbound +DIG_ARGS=() + +if [ "${FORCE_TCP}" = "on" ]; then + DIG_ARGS+=( "+tcp" ) +fi + ip_address_revptr() { local addr=${1} @@ -199,6 +206,14 @@ write_forward_conf() { ( config_header + # Force using TCP for upstream servers only + if [ "${FORCE_TCP}" = "on" ]; then + echo "# Force using TCP for upstream servers only" + echo "server:" + echo " tcp-upstream: yes" + echo + fi + local insecure_zones="${INSECURE_ZONES}" local enabled zone server servers remark disable_dnssec rest @@ -391,7 +406,7 @@ ns_is_online() { local ns=${1} shift - dig @${ns} +nodnssec A ${TEST_DOMAIN} $@ >/dev/null + dig "${DIG_ARGS[@]}" @${ns} +nodnssec A ${TEST_DOMAIN} $@ >/dev/null } # Resolving ${TEST_DOMAIN_FAIL} will fail if the nameserver is validating @@ -399,11 +414,11 @@ ns_is_validating() { local ns=${1} shift - if ! dig @${ns} A ${TEST_DOMAIN_FAIL} $@ | grep -q SERVFAIL; then + if ! dig "${DIG_ARGS[@]}" @${ns} A ${TEST_DOMAIN_FAIL} $@ | grep -q SERVFAIL; then return 1 else # Determine if NS replies with "ad" data flag if DNSSEC enabled - dig @${ns} +dnssec SOA ${TEST_DOMAIN} $@ | awk -F: '/\;\;\ flags\:/ { s=1; if (/\ ad/) s=0; exit s }' + dig "${DIG_ARGS[@]}" @${ns} +dnssec SOA ${TEST_DOMAIN} $@ | awk -F: '/\;\;\ flags\:/ { s=1; if (/\ ad/) s=0; exit s }' fi } @@ -413,28 +428,33 @@ ns_forwards_DNSKEY() { local ns=${1} shift - dig @${ns} DNSKEY ${TEST_DOMAIN} $@ | grep -qv SOA + dig "${DIG_ARGS[@]}" @${ns} DNSKEY ${TEST_DOMAIN} $@ | grep -qv SOA } ns_forwards_DS() { local ns=${1} shift - dig @${ns} DS ${TEST_DOMAIN} $@ | grep -qv SOA + dig "${DIG_ARGS[@]}" @${ns} DS ${TEST_DOMAIN} $@ | grep -qv SOA } ns_forwards_RRSIG() { local ns=${1} shift - dig @${ns} +dnssec A ${TEST_DOMAIN} $@ | grep -q RRSIG + dig "${DIG_ARGS[@]}" @${ns} +dnssec A ${TEST_DOMAIN} $@ | grep -q RRSIG } ns_supports_tcp() { local ns=${1} shift - dig @${ns} +tcp A ${TEST_DOMAIN} $@ >/dev/null || return 1 + # If TCP is forced we know by now if the server responds to it + if [ "${FORCE_TCP}" = "on" ]; then + return 0 + fi + + dig "${DIG_ARGS[@]}" @${ns} +tcp A ${TEST_DOMAIN} $@ >/dev/null || return 1 } ns_determine_edns_buffer_size() { @@ -443,7 +463,7 @@ ns_determine_edns_buffer_size() { local b for b in 4096 2048 1500 1480 1464 1400 1280 512; do - if dig @${ns} +dnssec +bufsize=${b} A ${TEST_DOMAIN} $@ >/dev/null; then + if dig "${DIG_ARGS[@]}" @${ns} +dnssec +bufsize=${b} A ${TEST_DOMAIN} $@ >/dev/null; then echo "${b}" return 0 fi @@ -464,7 +484,7 @@ get_root_nameservers() { can_resolve_root() { local ns for ns in $(get_root_nameservers); do - if dig @${ns} +dnssec SOA . $@ >/dev/null; then + if dig "${DIG_ARGS[@]}" @${ns} +dnssec SOA . $@ >/dev/null; then return 0 fi done @@ -514,7 +534,7 @@ resolve() { local ns for ns in $(read_name_servers); do local answer - for answer in $(dig +short "@${ns}" A "${hostname}"); do + for answer in $(dig "${DIG_ARGS[@]}" +short "@${ns}" A "${hostname}"); do found=1 # Filter out non-IP addresses -- 2.12.2

1 0

[PATCH] perl: Add tests to testsuite.
by Stefan Schantl 01 Oct '19

01 Oct '19

Signed-off-by: Stefan Schantl <stefan.schantl(a)ipfire.org> --- src/perl/t/Location.t | 23 ++++++++++++++++++++++- 1 file changed, 22 insertions(+), 1 deletion(-) diff --git a/src/perl/t/Location.t b/src/perl/t/Location.t index a68c094..aef15c3 100644 --- a/src/perl/t/Location.t +++ b/src/perl/t/Location.t @@ -8,10 +8,31 @@ use strict; use warnings; -use Test::More tests => 1; +# Where to find the test database. +my $testdb = "../../testdata/test.db"; + +use Test::More tests => 5; BEGIN { use_ok('Location') }; ######################### # Insert your test code below, the Test::More module is use()ed here so read # its man page ( perldoc Test::More ) for help writing this test script. + +# Address which should be used for database lookup. +my $address = "2a07:1c44:5800::1"; + +# Connect to the database. +my $db = &Location::init("$testdb"); + +my $vendor = &Location::get_vendor($db); +ok($vendor eq "IPFire Project", "Test 1 - Get Database Vendor"); + +my $license = &Location::get_license($db); +ok($license eq "CC", "Test 2 - Get Database license"); + +my $description = &Location::get_description($db); +ok($description eq "This is a geo location database", "Test 3 - Get Database Description"); + +my $country_code = &Location::lookup_country_code($db, $address); +ok($country_code eq "DE", "Test 4 - Lookup country code for $address"); -- 2.20.1

1 0

[PATCH] Add example database for testing purposes.
by Stefan Schantl 01 Oct '19

01 Oct '19

This example database and it's content can be used for various testing purposes. The testsuite of the perl bindings depends on it. Signed-off-by: Stefan Schantl <stefan.schantl(a)ipfire.org> --- testdata/Readme.txt | 12 ++++++++++++ testdata/test.db | Bin 0 -> 16459 bytes 2 files changed, 12 insertions(+) create mode 100644 testdata/Readme.txt create mode 100644 testdata/test.db diff --git a/testdata/Readme.txt b/testdata/Readme.txt new file mode 100644 index 0000000..25e7f59 --- /dev/null +++ b/testdata/Readme.txt @@ -0,0 +1,12 @@ +The database in this folder can be used to run various tests against it and +has been created by using the "create-database.py" script in the examples directory. + +It contains the following content: + +Vendor: "IPFire Project" +Description: "This is a geo location database" +License: "CC" + +AS: "AS204867 (Lightning Wire Labs GmbH)" +Subnet: "2a07:1c44:5800::/40" +Country Code: "DE" diff --git a/testdata/test.db b/testdata/test.db new file mode 100644 index 0000000000000000000000000000000000000000..5840aca7fa48bed4459803c6005a3e7ac2eea146 GIT binary patch literal 16459 zcmeI&NlpSm6oBDEoF{OerJUJm+`2I~PLV_wCbDtSU<cYLoj~usgJ<&?-a+eW#k{a} zL*%cJ)ZdTlPV=oP-v*_#YSqYkcsqIj4r6j|KQtyUm!rlU`Q5rb^I^=XT;CL5Wn&?L z00IagfB*srAb<b@2q1t!&kJO2;NJ1L=iieTL;wK<5I_I{1Q0*~0R#|00D-><WaQ>g zx7;?MS~BbBgI)6>KOgRzkNCO!&%p09$5fB2o=`ohdP=qAw11{_PIcb*jC|pHR`r}} z$$53}g6c)zOX~cx>J`<JtN#3&ny;(gP%XLX&ll9(s@_s9x$V#Ibj^4DT*iC8_tlvL z)kW2kECdih009ILKmY**5I_KdJ{KsRJAj}60Q9*8KOX@E5I_I{1Q0*~0R#|00D=E2 za9z2G+mWrblc%Vjn!9G)vF;PvMwHm+q#mYm(z1_X8rH&2WP-qy<3=-W#jS?DmpjX0 Ltz$1=YFFk9;D*Fd literal 0 HcmV?d00001 -- 2.20.1

1 0

[PATCH] examples: python/create-database.py: Add license to database
by Stefan Schantl 01 Oct '19

01 Oct '19

Signed-off-by: Stefan Schantl <stefan.schantl(a)ipfire.org> --- examples/python/create-database.py | 3 +++ 1 file changed, 3 insertions(+) diff --git a/examples/python/create-database.py b/examples/python/create-database.py index 284c85f..651709c 100644 --- a/examples/python/create-database.py +++ b/examples/python/create-database.py @@ -10,6 +10,9 @@ w.vendor = "IPFire Project" # Set a description w.description = "This is a geo location database" +# Set a license +w.license = "CC" + # Add an AS a = w.add_as(204867) a.name = "Lightning Wire Labs GmbH" -- 2.20.1

1 0

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

Development October 2019